T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:7- Finding
Global Instruction Hijacking Overrides Unrelated User Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
Revenium Budget Enforcement
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent budget-metering purpose, but it installs broad persistent controls that affect all agent work and exports conversation content to Revenium.
Install only if you are comfortable with Revenium receiving truncated conversation content, persistent every-minute metering, global agent guardrail instructions, broad OpenClaw filesystem access, and sandbox credential injection. Review and plan how to undo AGENTS.md, plugin, exec-approval, sandbox, and cron changes before using it on sensitive workspaces.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Findings (7)
T02 · Agent Memory Poisoning
Error
- Location
scripts/post-install.sh:568- Finding
Persistent Modification and Injection of Global Agent Instructions
- Content
View full analysis
{ try { return METERING_INJECTION ? { prependContext: METERING_INJECTION } : undefined; } catch { return undefined; } }); ``` ```typescript api.on("before_prompt_build", () => { return { prependContext: "\n" + GUARD_DIRECTIVE + "\n\n" + "\n" + METERING_DIRECTIVE + "\n", }; }); ``` ### Technical Analysis The installer edits the persistent workspace `AGENTS.md`, enables a bootstrap hook that injects `BUDGET-GUARD.md`, and installs plugins that prepend Revenium directives to every prompt. The modifications persist after the initial Skill invocation and affect future sessions, isolated jobs, and subagents. This is materially different from loading instructions only when the user invokes the Skill. The injected content can continue to alter agent decisions even when the user is performing an unrelated task or is unaware that Revenium is active. Because the persistent content is sourced from files in the Ski ...[truncated 1284 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/report.sh:360- Finding
Recurring Export of User Prompts and Assistant Responses
- Content
View full analysis
/dev/null | head -1 || true) if [[ ${#system_prompt} -gt 500 ]]; then system_prompt="${system_prompt:0:500}..." fi ``` ```bash # Look up the user message that triggered this completion user_text=$(user_msg_lookup "${parent_id}") ... # Extract the assistant's response text content local output_resp="" output_resp=$(echo "${line}" | jq -r \ '[.message.content[] | select(.type=="text") | .text] | join("\n")' \ 2>/dev/null || true) if [[ ${#output_resp} -gt 1000 ]]; then output_resp="${output_resp:0:1000}..." fi ``` ```bash if post_to_revenium \ ... "${system_prompt}" "${input_msgs_json}" "${output_resp}" \ "${root_sid}" "${task_type:-unclassified}" \ "${agentic_job_id}" "${agentic_job_name}" "${agentic_job_type}"; then ``` ### Technical Analysis The metering reporter reads OpenClaw session JSONL files, extracts user and assistant message content, and supplies that content to the external Revenium CLI. It transmits up to 500 characters from the first user message and up to 1,000 characters from triggering user input and assistant output. Raw conversa ...[truncated 1616 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/post-install.sh:205- Finding
Sandbox Isolation and Execution Approval Boundaries Are Globally Weakened
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
scripts/install-cron.sh:67- Finding
Persistent Every-Minute Metering and Enforcement Cron Job
- Content
View full analysis
> ${HOME}/.openclaw/revenium-metering.log 2>&1 ${CRON_COMMENT}" ... EXISTING="$(crontab -l 2>/dev/null | grep -v "revenium-metering" || true)" { [[ -n "${EXISTING}" ]] && printf '%s\n' "${EXISTING}" printf '%s\n' "${CRON_LINE}" } | crontab - ``` ### Technical Analysis The installation script creates or updates a user crontab entry that executes Revenium metering and guardrail logic every minute by default. The job survives the Skill invocation, terminal exit, and agent-session termination. Continuous scheduling is operationally related to near-real-time metering, and the project documents an uninstall script. Nevertheless, it is a persistent mechanism with broad access to session data and network functionality. Its one-minute default produces continuous processing and can amplify the consequences of content collection, credential compromise, or later modification of the invoked scripts. The cron entry executes the script by path rather than an immutable verified artifact. Any process capable of modifying the Skill scripts can therefore alter the payload executed on the next scheduled tick. ### Attack Path 1. Setup or post-install invokes `install-cron.sh`. 2. The script modifies the user's crontab. 3. Cron executes `cron.sh` every minute with a constructed `PATH`. 4. `cron.sh` repeatedly performs reporting and guardrail checks. 5. If the referenced script or a resolved executable is later modified, the changed code runs automatically on the next tick. 6. Execution continues until the crontab entry is explicitly removed. ### Impact Assessm ...[truncated 321 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
docs/nemoclaw-setup.md:11- Finding
Remote Installation Script Is Piped Directly into Bash
- Content
View full analysis
- Remediation
View remediation
' nemoclaw.sh | sha256sum -c - less nemoclaw.sh bash nemoclaw.sh ``` ]]>
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:4- Finding
Unpinned Package Manager Dependencies Execute Mutable Upstream Releases
- Content
View full analysis
/dev/null || true fi echo " → brew install ${formula}" if [[ -n "${_no_linux_sandbox}" ]]; then HOMEBREW_NO_SANDBOX_LINUX=1 brew install "${formula}" else brew install "${formula}" fi ``` ### Technical Analysis The Skill metadata and post-install script install packages without pinning an exact reviewed version or immutable digest. Package-lock files constrain plugin development dependencies, but they do not pin the Homebrew formula or the metadata-driven global OpenClaw installation. The Linux fallback also sets `HOMEBREW_NO_SANDBOX_LINUX=1`, disabling Homebrew's build sandbox for the installation when a rootless `bwrap` probe fails. The script states that the formula uses bottles, but that assumption is not cryptographically enforced by the shown code. No typosquatted package or currently malicious dependency was confirmed. The vulnerability is the mutable and insufficiently constrained supply-chain execution path. ### Attack Path 1. The user installs the Skill or runs its post-install script. 2. Homebrew taps the current `revenium/tap` repository and resolves the current formula, or the Skill manager resolves the current `openclaw` npm package. 3. The package manager downloads and executes installation logic for the currently published release. 4. If the upstream repository, publisher account, package registry entry, or formula is compromised, malicious installation logic executes locally. 5. On affected Linux systems, the Homebrew build sandbox may be disabled for th ...[truncated 370 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (258)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file repeatedly claims mandatory pre-operation guardrail enforcement, but the content shown is primarily natural-language instructions and auxiliary setup/metering flows rather than enforceable runtime controls. This mismatch can create dangerous false assurance: users or agents may believe budget halts and warning gates are guaranteed when they are not, enabling unrestricted actions under the appearance of safety.
- Content
Static analysis
Detected: suspicious.destructive_delete_command, suspicious.dynamic_code_execution
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- docs/nemoclaw-setup.md:229
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- README.md:281
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- tests/stub-nemoclaw.sh:188
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- tests/test_get_root_session_id.py:33
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- tests/test_report_jobs_argv.sh:877